DVA-C02 Security Practice Question
A developer needs to grant a user in another AWS account (Account B) read-only access to objects in an Amazon S3 bucket owned by Account A. The developer has already added a bucket policy that grants s3:GetObject access to the IAM user in Account B. However, the user in Account B still gets Access Denied when trying to read objects. What additional configuration is required?
⚠ Common exam trap
It's easy for candidates to assume a bucket policy alone is sufficient for cross-account access, overlooking the requirement for an explicit IAM policy in the requesting account to allow the action.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The user in Account B must have an IAM policy that allows s3:GetObject on the bucket ARN
The bucket policy in Account A grants s3:GetObject access to the IAM user in Account B, but this alone is insufficient. For cross-account access, the IAM user in Account B must also have an IAM policy attached that explicitly allows s3:GetObject on the bucket ARN. Without this, the user’s own account denies the request before it reaches Account A’s bucket policy, resulting in Access Denied.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The user in Account B must have an IAM policy that allows s3:GetObject on the bucket ARN
Why this is correct
Cross-account access requires both a bucket policy that grants the user permissions and an IAM policy in the user's account that allows the action. The IAM policy is necessary because the default is to deny all actions.
- ✗
The bucket must be made public by unchecking 'Block all public access'
Why it's wrong here
Unchecking 'Block all public access' and configuring a bucket policy with a `Principal: "*"` would indeed make the S3 bucket publicly accessible to anyone on the internet. This approach is overly permissive and directly violates the principle of least privilege, which dictates granting only the minimum necessary permissions to specific identities. Granting read-only access to a specific user in another AWS account requires explicit cross-account policies, not making the resource public.
- ✗
The developer must create a new IAM role in Account A and have the user in Account B assume that role
Why it's wrong here
While creating an IAM role in Account A for the user in Account B to assume is a perfectly valid and often preferred method for cross-account access, it represents an alternative architectural approach rather than a solution to the current problem. The question implies the developer is attempting direct cross-account access using a bucket policy. In that scenario, the issue is not the lack of a role, but the incomplete configuration of the direct access method, specifically the missing IAM user policy in Account B.
- ✗
The user in Account B must use the S3 console instead of the AWS CLI
Why it's wrong here
The AWS Management Console, AWS CLI, and SDKs are all interfaces that interact with AWS services, and they all strictly enforce the same underlying authorization model. An 'Access Denied' error fundamentally indicates a lack of necessary permissions granted to the requesting principal by either an identity-based policy (IAM) or a resource-based policy (S3 bucket policy). Switching between these tools will not alter the permissions associated with the user's identity, thus it will not resolve a permissions-related error.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 724 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DVA-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A developer needs to allow users from another AWS account (account ID: 123456789012) to read objects in an S3 bucket owned by the developer's account. The developer wants to use a bucket policy and does not want to create IAM users in the other account. Which bucket policy statement achieves this securely?
medium- A.{"Principal": "*", "Action": "s3:GetObject", "Effect": "Allow", "Resource": "arn:aws:s3:::bucket/*", "Condition": {"StringEquals": {"aws:SourceAccount": "123456789012"}}}
- ✓ B.{"Principal": {"AWS": "arn:aws:iam::123456789012:root"}, "Action": "s3:GetObject", "Effect": "Allow", "Resource": "arn:aws:s3:::bucket/*"}
- C.{"Principal": {"AWS": "arn:aws:iam::123456789012:user/cross-account-user"}, "Action": "s3:GetObject", "Effect": "Allow", "Resource": "arn:aws:s3:::bucket/*"}
- D.{"Principal": {"AWS": "arn:aws:iam::123456789012:role/cross-account-role"}, "Action": "s3:GetObject", "Effect": "Allow", "Resource": "arn:aws:s3:::bucket/*"}
Why B: It uses the AWS account root principal ARN (arn:aws:iam::123456789012:root) to grant cross-account access to the S3 bucket. This allows any IAM user or role in the external account to read objects, provided the external account's administrator delegates permissions via IAM policies. The bucket policy does not require creating IAM users in the other account, aligning with the requirement.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.